SANS ISC: Cyber Security Awareness Month - Day 15 - What Teachers Need to Know About Their Students - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Today's cyber security awareness month topic looks at the problem through the eyes of the teacher.  For most students, their teachers are not just people well versed in economics, mathematics, science, or history.  They also serve as mentors, role models, and confidants to their students and are expected to be able to demonstrate their vast knowledge of how to conduct one's self in today's society.  Unfortunately for many educators, especially those who are a bit advanced in their years, this new thing called the Internet has created a very large divide between students and their teachers, often leaving the teacher with little understanding of how to integrate their students' online experience into the classroom, the playground, homework, and extracurricular activities.

There are many resources online with ideas for teachers in terms of teaching cyber security ethics and etiquette to their students.  For example, see

http://www.staysafeonline.org/cybersecurity-awareness-month/what-educators-can-do

and

https://wiki.internet2.edu/confluence/display/itsg2/Cybersecurity+Awareness+Resource+Library

But what we need to ask is "what should teachers know about their students?"  Being a parent with both of my daughters out of school and on their own (OK, my youngest is in grad school...) I have many years of experience watching the divide between them and their teachers as they were growing up.  Here are some of my observations, known to many of their teachers but completely unknown to others:

• Homework is often done in collaboration with other classmates via online chat rooms, even if told to do it alone
• Wikipedia is more valid as a research tool than the school library
• In chat rooms and social media sites students can be very vicious with their comments about other students, their teachers, and their schools
• Access to computers and the Internet is everywhere, and when told that they cannot use the Internet they will find a way to do so
• There is little respect for authority while online, causing some students to routinely break laws that they would not dare to do in the physical world (for example, theft of intellectual property via file-sharing sites, or accessing pornography that is restricted to adults over the age of 18)
• Students have created sites such as http://www.ratemyteachers.com/ where they discuss and "rate" their schools and teachers

I know that the list above is more focused on the dark side of what "digital students" are thinking and doing, but there are certainly many good things that the Internet brings which were not available to us when we were growing up.  So now it's your turn - use the "comment" link below to add your own observations about what teachers should know about their students when it comes to online behavior.  It doesn't matter if you are a teacher, a student, a parent, or a friend, let us know what you are seeing and hearing.  And while talking about the bad stuff students do is useful for awareness, we also would like to hear about the good things they are doing, too!

Marcus H. Sachs
Director, SANS Internet Storm Center

Staying on the negative side of things, I would add:
- Any new "necessary" electronic device or advancement in computers creates a new opportunity for clever students to cheat. For example, consider handheld video games with wireless chat or internet capability, bluetooth headsets, and smartphones. Devices that were once dumb now have many added features. Consider how few teachers realized that students were storing notes in their programmable calculators when they were introduced to schools two decades ago.

Did you mean 'vicious' instead of 'viscous?' I can see both words as being valid.

Good catch CoastalView! I just changed it.

Good Article! My oldest just started junior high and I watch his online activity pretty cloesly. I noted that his friends were bragging on Facebook about owning the proxy and were now able to surf where ever they wanted during class. I had to laugh because the schools web-site proudly announces their new wireless network is up and running and is secure for the safety of the staff and students. Of cousre, I sent a note to the network administrator with some suggestions about securing and monitoring, OpenDNS for a start.

I believe that teachers should be supporting their students in the use of all things Internet. Teachers and students alike should accept that 'some bad things happen', and that so long as you only bet with money (or reputation ...) that you are willing to lose, then you should go on, try it, see what happens, and learn from the experience (good or bad).

I'm kind-of considering that the world (in particular the USA and Europe) needs more science-technology-engineering-math skilled people; and that a healthy attitude towards experimenting with Internet is likely to achieve this better.

So I wouldn't watch, and I wouldn't expect anyone to watch me.

I think that's the "Common Carrier" argument. Would anyone like to discuss it ?

> ... and I watch his online activity pretty cloesly. (RobM)

> ... So I wouldn't watch, and I wouldn't expect anyone to watch me. (Chris)

I'd watch, but I'd allow some slack (for learning through experience). You DO monitor your day-job logs, don't you?

> I think that's the "Common Carrier" argument. Would anyone like to discuss it ?

I am not ashamed of acting "in loco parentis" when I AM a parent!

I work in the I.T. department for a school district and one problem is that a lot of teachers do not know how to challenge the students with technology. The result then is that students will become bored and spend of their computer time trying to find an unblocked website with flash games.

At one of our school clients, a student kept bragging or threatening that he could "take down the school any time he wanted" since it was so insecure. Other than asking us whether this was possible, the school staff did not consider this matter any more important than the student "getting attention." When I asked, if the student had threatened to burn the school building down would that be treated differently, the answer was that "it was only computer stuff" and not considered important. I was flummoxed at that. Since they considered it confidential, there was no information whatsoever provided so we could have monitored any activity of the student, nor could they identify any computers he/she may have used so they could be checked.

As to the student's claim, our answer was "maybe" for any given definition of "take down the school." Our contact did explain the student was advised that the school network was not more secure as it was a trusted environment and that responsible students would not abuse the school's resources. On thought, that was not unreasonable, in their environment. (Our advice for higher security have been met with their acceptance of the level of risk for a more trusted environment - which is, of course, their choice.)

"Unfortunately for many educators, especially those who are a bit advanced in their years, this new thing called the Internet has created a very large divide between students and their teachers, often leaving the teacher with little understanding of how to integrate their students' online experience into the classroom, the playground, homework, and extracurricular activities."

I couldn't agree more. There is sometimes and epic void between students and instructors. However, I believe even the oldest and most out of touch instructor can teach students lessons that only can be learned with real life experience. Granted, if it is an IT related class, then the teacher should be well versed in IT and computers.